Rapid7 Details Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)
Rapid7 has published a technical analysis and proof-of-concept for CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint Server Subscription Edition that allows remote attackers to impersonate any user.
Rapid7 has released a detailed technical analysis of CVE-2026-55040, a critical authentication bypass vulnerability affecting Microsoft SharePoint Server Subscription Edition. The vulnerability, initially disclosed in coordination with Microsoft on July 14, 2026, allows a remote, unauthenticated attacker to forge a valid JSON Web Token (JWT) and gain unauthorized access as any user on a vulnerable SharePoint server.
The core of the exploit lies within a chain of four distinct weaknesses identified in SharePoint's JWT token validation pipeline, specifically within the SPJsonWebSecurityTokenHandlerV2 class and its base class SPJsonWebSecurityBaseTokenHandlerV2. These classes are responsible for parsing and validating Bearer service-to-service (S2S) tokens used in SharePoint's authentication mechanisms.
One of the most significant flaws is the explicit disabling of signature verification. The SPJsonWebSecurityTokenHandlerV2 class sets RequireSignedTokens to false during token validation. This setting bypasses the JWT library's cryptographic signature checks, allowing tokens with an alg: none header to be accepted without cryptographic validation. This effectively removes a fundamental security layer for JWTs.
Further weaknesses exploit the nested JWT structure used by SharePoint. The outer token contains user identity claims, while an inner "actor token" is embedded within the actortoken claim. This actor token is intended to represent the calling application and must be cryptographically signed by a trusted certificate. However, the validation process exhibits additional vulnerabilities that allow an attacker to manipulate or bypass these checks.
Specifically, the analysis points to issues in how the inner actor token's signature is validated. By chaining these JWT validation weaknesses, an attacker can craft a malicious token that the SharePoint server will accept as legitimate, granting them the privileges of any user, including administrators. The proof-of-concept (PoC) script provided by Rapid7 demonstrates the feasibility of this attack.
The vulnerability affects SharePoint Server Subscription Edition version 16.0.19725.20210. While Microsoft has addressed this vulnerability, the detailed technical breakdown by Rapid7 provides crucial insights for security professionals to understand the attack vector and enhance their defenses against similar authentication bypass techniques.
This discovery underscores the persistent threat of authentication bypass vulnerabilities in complex enterprise software. Organizations relying on SharePoint are urged to ensure they have applied all relevant security updates to mitigate the risk of exploitation. The detailed analysis serves as a valuable resource for understanding the intricacies of JWT validation and the potential pitfalls in its implementation.
This new report from Rapid7 details a second vulnerability, CVE-2026-63520, which when chained with CVE-2026-55040, creates a critical unauthenticated remote code execution exploit chain against Microsoft SharePoint. The RCE vulnerability stems from an unsafe .NET type instantiation in Business Connectivity Services and affects SharePoint, Project Server, and Office Web Apps Server, while the previously disclosed CVE-2026-55040 only impacts SharePoint.
This new report details the full exploit chain, which combines the CVE-2026-55040 authentication bypass with a separate remote code execution vulnerability (CVE-2026-63520) in SharePoint's Business Connectivity Services. This combination allows unauthenticated attackers to achieve remote code execution with the privileges of the server's Windows service account. The article also highlights that an AI agent played a significant role in discovering this combined exploit, underscoring the evolving landscape of AI in cybersecurity research.
Exploitation in the wild has now been confirmed for CVE-2026-55040, a SharePoint vulnerability detailed by Rapid7, shortly after the release of a proof-of-concept exploit. Threat intelligence firm Defused reported observing attacks targeting the flaw on August 12, leveraging the PoC script made available by Rapid7. While Microsoft's advisory for the July patch does not yet mention active exploitation, this development aligns with CISA's recent warnings about the vulnerability's potential for in-the-wild attacks.
Attackers are now actively exploiting CVE-2026-55040, a critical Microsoft SharePoint vulnerability allowing authentication bypass, following the public release of a proof-of-concept exploit by Rapid7. This exploitation surge, with 12 attempts recorded since July 19th and eight occurring in the last two days, highlights the immediate danger posed by publicly available exploit code. The vulnerability, patched by Microsoft in its July 2026 Patch Tuesday updates, allows unauthenticated attackers to impersonate users and modify data.
This new article confirms that threat actors are actively exploiting CVE-2026-55040 in real-world attacks, just hours after the proof-of-concept exploit was released. It details how attackers are using the exploit to impersonate users, including administrators, and notes that the vulnerability can be chained with CVE-2026-63520 for remote code execution.
Following the public release of proof-of-concept exploit code by Rapid7, threat actors have begun actively exploiting the critical Microsoft SharePoint vulnerability, CVE-2026-55040. This flaw, which allows for authentication bypass and user impersonation, was patched by Microsoft in its July 2026 Patch Tuesday updates. The exploitation allows attackers to potentially disclose files and modify data, though Microsoft notes it does not impact availability.